RFID risk management: although there are many benefits to using the new RFID technology, careful thought must be given to the possible risks that come with it

Internal Auditor, April, 2005 by John Kopalchick, III, Christopher Monk

PICTURE YOUR GROCERY STORE. Think of the cookie aisle and remember the last time you took a package off the shelf. Now, imagine that at the moment you put that package into your cart, the stockroom receives a real-time message from the inventory system that an item has been removed from the shelf and needs to be replenished. At the same time, a middleware application, using predefined business rules, automatically generates a replenishment ticket for the stocker and sends an order to the distribution center, adding the item to the store's next order. The manufacturer of the product receives notice that the distribution center inventory has been reduced and is able to monitor and replenish inventory based on defined business rules. Although this scenario may seem like something out of a "Star Trek" episode, it is not that far away. Called radio frequency identification or RFID, rudimentary versions of this hot, new technology are being used today, probably more often than most of us are aware.

[ILLUSTRATION OMITTED]

RFID is transforming the way business is conducted. Some pundits think RFID could surpass the billions of dollars spent on bar-code technology in the 1980s, when it made its debut. Business consulting firm Frost and Sullivan predict spending on RFID technology and related process and systems integration will top US $7 billion by the year 2008. Already, several large manufacturers, distributors, and retailers have made RFID a top priority. Retail giants such as Wal-Mart, Target, and Albertsons grocery have mandated RFID capabilities at the case-and-pallet level to their top suppliers this year and will introduce further requirements by 2006. These mandates are affecting major consumer product manufacturers, including Gillette Co. and Procter & Gamble.

Even the U.S. government has made RFID a major initiative: The Department of Defense is requiring that all of its suppliers be RFID compliant. To alleviate the issue of counterfeit drugs flooding the United States, the Food and Drug Administration has issued a mandate for all pharmaceutical companies to begin tagging products with RFID chips at the bottle level. When used for asset tracking and supply-chain security purposes, industries such as media and communications, telecommunications, manufacturing and distribution, airline, and energy will be affected as well.

As chip prices drop and the size of integrated circuits continues to decrease, new applications for improving supply-chain visibility, inventory management, asset tracking, and supply chain security will begin to emerge. Although the journey to tagging at the item level will take five to 10 years, companies are moving toward implementing RFID capabilities, which will increase the risk and control implications as a result of this transforming technology. Because RFID will increasingly impact supply chain and operations executives, as well as others, the internal audit and risk management communities will need to focus on this technology.

HOW THE TECHNOLOGY WORKS

The modern application of RFID is often referred to as a class of smart technologies that enables object-to-object communication. A small transponder, or "tag," containing a microchip attached to an antenna is inserted into an object's or product's packaging or label. As the item moves past a reader--for example, a pallet moving into a warehouse from a supplier--the reader, which is embedded in the ceiling at the dock's doors, converts the radio waves from the tag into information that can then be used by computers.

The information read from the tag is analogous to a license plate for each item. One proposed universal standard for the license-plate information on the tag is the electronic product code (EPC), which, similar to bar codes, is divided into segments that have identifiers for the manufacturer, product, and version. However, unlike bar codes, the tag also contains a specific serial number for that distinct product. The information about that product is housed on a server and an object name service (ONS) points the computer to another server where information about the product is stored. The physical tag serves as the product's physical DNA while the EPC serves as the product's genetic code housing detailed information about the product's physical description, location history, and manufacturing location and date. The ONS can reference servers on-site or at the supplier or independent providers that house the information.

There are two basic forms of RFID tags: active and passive. Both forms contain a microprocessor attached to an antenna, but active tags also contain a battery, which allows them to send their information over longer ranges. The battery also can power the chip's circuitry to perform other functions such as monitoring the environment. For example, active tags can communicate end-of-shelf-life status, changes in pressure and temperature, traces of radiation or chemicals, or evidence of tampering. Passive tags simply use the electromagnetic waves sent out by the reader as the power source to transmit their information.